PT-2006-3398 · Caucho · Caucho Resin

Joseph Pierini · Publicado 2006-05-17 · Atualizado 2011-03-08 · CVE-2006-2437

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Caucho Resin versions 3.0.17 through 3.0.18

Description The issue allows remote attackers to obtain the source code for files under the web root. This is achieved through the file parameter in the viewfile servlet, which is part of the documentation package (resin-doc) for Caucho Resin.

Recommendations For versions 3.0.17 and 3.0.18, consider restricting access to the viewfile servlet to minimize the risk of exploitation. As a temporary workaround, avoid using the file parameter in the affected servlet until a patch is available.

Exploit

Correção

Identificadores relacionados

CVE-2006-2437

Produtos afetados

Caucho Resin

Referências · 8

• 🔥 https://exploit-db.com/exploits/27888 · Exploit
• 🔥 http://securityfocus.com/archive/1/434145 · Exploit
• 🔥 http://securityfocus.com/bid/18007 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2437 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2437 · Nota de Segurança
• http://archives.neohapsis.com/archives/fulldisclosure/2006-05/0384.html · Nota
• http://securityreason.com/securityalert/908 · Nota
• http://vupen.com/english/advisories/2006/1831 · Nota